Consent-Friendly EU Analytics With iubenda, Fathom and GA4

The short answer: for a Dutch or EU site that runs Google Ads, the setup that holds is two counts, not one: GA4 behind a consent banner with Consent Mode, and a cookieless counter beside it, for €4.99 a month for iubenda Essentials billed yearly up to 25,000 pageviews (iubenda pricing) and $15 a month for Fathom up to 100,000 (Fathom pricing, both checked on 26 October 2026). Then trust each for a different job. GA4 only models the visitors who refuse once a property sends 1,000 events a day with analytics consent denied for 7 days and has 1,000 consenting daily users on 7 of the previous 28 days (GA4 behavioral modeling); below that, its reports describe the people who said yes.

Disclosure: I may earn a commission through some links on this site. It does not change what this page says.

None of this is legal advice. It puts law, setup and numbers in one order, and marks the decisions that belong to counsel.

Before anything goes on the site:

1. Check whether modelling will exist for you at all. For example, if 60% of visitors accept, reaching 1,000 consenting daily users takes 1,000 / 0.6 = 1,667 daily users in total. A site whose GA4 shows 1,200 on an ordinary weekday gets observed data and nothing estimated, and should plan its reports that way.
2. Start from the register you already have. Export the tags in your Tag Manager container and list any script pasted into the theme by hand. The agent checks the scan against that list.
3. Write the questions for counsel now. They are listed in the next section, and two of them change how the tools are configured.
4. Take four weeks of GA4 users and sessions before the banner changes. Without that baseline, nobody can say afterwards whether a drop came from consent or from the market.

What the rules say, and what to ask counsel

Article 5(3) of the ePrivacy Directive, in the version amended by Directive 2009/136/EC, allows storing information on a user's device, or reading what is stored there, only once the user has consented after clear and comprehensive information about the purposes. The exceptions are storage or access for the sole purpose of transmitting a communication, and what is strictly necessary to provide a service the user explicitly asked for (consolidated text on EUR-Lex).

The Netherlands implements this in Article 11.7a of the Telecommunicatiewet. In the version in force from 15 August 2026, paragraph 3(b) adds a Dutch exception beside the strictly necessary one: storage or access to obtain information about the quality or effectiveness of a delivered service, provided it has no or only minor consequences for the user's privacy (Telecommunicatiewet, article 11.7a). The Autoriteit Persoonsgegevens tells organisations they may place only functional cookies and limited analytics cookies, those with little to no impact on privacy, without consent; if limited analytics cookies process personal data, the site still needs a legal basis and must name them in its privacy statement (AP on cookies, AP guidance for organisations).

Where exactly that line runs is not settled. In a letter of 13 November 2025 the AP wrote that the Autoriteit Consument & Markt supervises the cookie provision, that the AP has proposed taking over that supervision, and that it is examining which cookies fall under the exception, with the timing of any answer depending partly on that change (AP letter on Google Analytics, PDF).

Questions to put to counsel, in writing:

• Does this GA4 configuration, linked to Google Ads, count as limited analytics under paragraph 3(b), or must it wait for consent?
• May the cookieless counter load before the visitor chooses, as configured, and what must the privacy statement say about it?
• In Advanced Consent Mode, Google tags load before the choice and send measurements without cookies while consent is denied (Consent Mode overview). Must the banner cover that, or is Basic the safer choice?
• Which other EU countries does the site serve? Fathom's own ePrivacy guide notes that national implementation matters (Fathom ePrivacy guide).

The setup, in order

1. Triggers. A monthly check, plus any release that touches the site's head or the Tag Manager container.
2. Banner and blocking. On any platform, iubenda's banner with auto-blocking holds back non-essential scripts, and its Consent Mode support is listed for all plans, the free one included (iubenda Consent Mode). On WordPress, Complianz Premium does the same job for $59 a year for one site (Complianz pricing). Set Basic or Advanced to match counsel's answer; the setup steps are in how to block trackers until consent with iubenda and Consent Mode v2 with Complianz.
3. The second count. Fathom's visitor analytics sets no tracking cookies and builds site-specific signatures with a salt that rotates daily, and its compliance overview adds that cookie-free does not automatically mean outside device-access rules (Fathom compliance). Load it before or after consent as counsel decides; campaign tracking is in how to use Fathom Analytics.
4. The agent reads and decides. With the iubenda connector in Claude or ChatGPT, ask: "Scan my site and tell me what trackers are running," then "Check what's already set up on my site." The scan lists trackers and third-party services in a minute or two, and the connector can also add clauses to the live policy (iubenda connector). Paste in your register and ask for three lists: services in the scan but not the register, services in the register the scan did not find, and a proposed category for each new one.
5. The human check. The connector confirms before anything is finalised or deleted, so the privacy owner approves each proposed clause and category. Nothing goes into Necessary unless the site cannot run without it, because iubenda loads anything in that category without consent (auto-blocking guide). Then open the site in a private window, refuse everything, and watch the network tab.
6. The output. An updated policy and banner, and one dated line in the register: what the scan found, what changed, who approved it.

Which numbers to trust afterwards

GA4 in Basic mode blocks Google tags until the visitor interacts with the banner; a refusal sends Google nothing at all, and conversion modelling in Ads falls back to a general model (Consent Mode overview). Its reports describe people who accepted. Use them for behaviour and paths, not for totals.

GA4 in Advanced mode, once eligible, shows estimated users only when the reporting identity is set to Blended, and the data-quality icon says so (GA4 behavioral modeling). The same article says modelling applies to users, sessions and new users but not to event counts such as page_view, first_visit and session_start, so refusers' page loads can push first visits up. Modelled data is also left out of audiences, retention reports and the BigQuery export. A total built from both mixes an estimate with a count; label it.

Fathom counts visits for everyone it loads for. Its daily salt rotates at midnight UTC, which limits continuity between days (salts and hashes), so the same person on Monday and Thursday counts as two visitors. Trust it for traffic levels and trends; never for monthly unique people.

The rule that follows: never add a GA4 figure to a Fathom figure, and never swap one for the other in a report without saying so.

Free first, then what paying adds

The free version is real. iubenda's free plan runs a banner with Consent Mode up to 5,000 pageviews a month, after which the banner is deactivated for the rest of that month (free plan limits); the connector works on it too. GA4 is free of charge (Google Analytics). For the tracker scan, the AP points to the EDPB's free website auditing tool, and for a second count it names Matomo, Apache Superset, Plausible Analytics and OpenPanel as alternatives, provided they are configured correctly (AP guidance for organisations). Fathom itself has no free plan; its trial lasts 7 days and asks for a card (Fathom pricing).

Paying adds headroom and less work: 25,000 pageviews instead of 5,000 and monthly site scans on iubenda Essentials (iubenda pricing), a counter you do not host, and an assistant that reads the scan against your register in one request.

Checked on 26 October 2026 on the pricing pages of iubenda, Complianz and Fathom, and on Google Analytics.

Fathom's pricing page lists "No cookie banners required" among what every plan includes, because a site without a banner is what it sells. Its own ePrivacy guide describes the same design as relevant to a privacy assessment but not a universal exemption from consent (Fathom ePrivacy guide). The guide is the one to hand counsel.

How to tell it is working

The measure is a weekly ratio: GA4 sessions divided by Fathom visits, for the same days and time zone. The two count different things, so it is not a consent rate, but its movement means something. The baseline is your four weeks from before the banner changed; record the ratio in the first week after.

A holdout does not fit a legal requirement, so the cookieless count plays that role: it keeps counting while the banner changes what GA4 sees. If the ratio jumps after a release, a tag is probably firing before consent, and the refused-consent test from step 5 finds it. If it slides over several weeks, fewer visitors are accepting; on WordPress, the A/B testing and statistics that Complianz Premium lists are the place to test banner wording (Complianz pricing), within whatever counsel allows. Plans and alternatives are in the entries for iubenda, Complianz and Fathom Analytics.

FAQ

Does cookieless analytics mean the banner can go?

Not by itself. The AP says a site that stops collecting personal data no longer needs to ask for consent and can drop the banner (AP guidance for organisations), but the ad tags, embeds and chat widgets on the same site usually still need it.

Why did GA4 first visits jump after switching to Advanced mode?

Because events from refusers become reportable while modelling leaves event counts like first_visit and session_start unmodelled, and each page load from a refuser can send them again (GA4 behavioral modeling).

Can the iubenda connector change my live policy without me?

It acts only after you sign in and approve access, and it confirms before anything is finalised or deleted (iubenda connector). Read each proposed clause before confirming it, since the policy it updates is the one visitors read.